TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-25 19:15:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn: include full tailfs shares in ipn notifications

Browse Source 
This allows the Mac application to regain access to restricted
folders after restarts.

Updates tailscale/corp#16827

Signed-off-by: Percy Wegmann <percy@tailscale.com>
This commit is contained in:
Percy Wegmann 2024-02-27 21:22:45 -06:00 committed by Percy Wegmann
parent 80f1cb6227
commit e324a5660f
5 changed files with 20 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/derper/depaware.txt
View File

@ -114,7 +114,7 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
💣 tailscale.com/safesocket from tailscale.com/client/tailscale
tailscale.com/syncs from tailscale.com/cmd/derper+
tailscale.com/tailcfg from tailscale.com/client/tailscale+
tailscale.com/tailfs from tailscale.com/client/tailscale
tailscale.com/tailfs from tailscale.com/client/tailscale+
tailscale.com/tka from tailscale.com/client/tailscale+
W tailscale.com/tsconst from tailscale.com/net/interfaces
tailscale.com/tstime from tailscale.com/derp+

8
ipn/backend.go
View File

@ -10,6 +10,7 @@
"tailscale.com/ipn/ipnstate"
"tailscale.com/tailcfg"
"tailscale.com/tailfs"
"tailscale.com/types/empty"
"tailscale.com/types/key"
"tailscale.com/types/netmap"
@ -123,11 +124,12 @@ type Notify struct {
ClientVersion *tailcfg.ClientVersion `json:",omitempty"`
// TailFSShares tracks the full set of current TailFSShares that we're
// publishing as name->path. Some client applications, like the MacOS and
// publishing as name->share. Some client applications, like the MacOS and
// Windows clients, will listen for updates to this and handle serving
// these shares under the identity of the unprivileged user that is running
// the application.
TailFSShares map[string]string `json:",omitempty"`
// the application. A nil value here means that we're not broadcasting
// shares information, an empty value means that there are no shares.
TailFSShares map[string]*tailfs.Share
// type is mirrored in xcode/Shared/IPN.swift
}

5
ipn/ipnlocal/local.go
View File

@ -68,6 +68,7 @@
"tailscale.com/syncs"
"tailscale.com/tailcfg"
"tailscale.com/taildrop"
"tailscale.com/tailfs"
"tailscale.com/tka"
"tailscale.com/tsd"
"tailscale.com/tstime"
@ -2286,9 +2287,9 @@ func (b *LocalBackend) WatchNotifications(ctx context.Context, mask ipn.NotifyWa
if err != nil {
b.logf("unable to notify initial tailfs shares: %v", err)
} else {
ini.TailFSShares = make(map[string]string, len(shares))
ini.TailFSShares = make(map[string]*tailfs.Share, len(shares))
for _, share := range shares {
ini.TailFSShares[share.Name] = share.Path
ini.TailFSShares[share.Name] = share
}
}
}

21
ipn/ipnlocal/tailfs.go
View File

@ -7,6 +7,7 @@
"encoding/json"
"errors"
"fmt"
"maps"
"os"
"regexp"
"strings"
@ -108,7 +109,7 @@ func normalizeShareName(name string) (string, error) {
return name, nil
}
func (b *LocalBackend) tailfsAddShareLocked(share *tailfs.Share) (map[string]string, error) {
func (b *LocalBackend) tailfsAddShareLocked(share *tailfs.Share) (map[string]*tailfs.Share, error) {
fs, ok := b.sys.TailFSForRemote.GetOK()
if !ok {
return nil, errors.New("tailfs not enabled")
@ -129,7 +130,7 @@ func (b *LocalBackend) tailfsAddShareLocked(share *tailfs.Share) (map[string]str
}
fs.SetShares(shares)
return shareNameMap(shares), nil
return maps.Clone(shares), nil
}
// TailFSRemoveShare removes the named share. Share names are forced to
@ -154,7 +155,7 @@ func (b *LocalBackend) TailFSRemoveShare(name string) error {
return nil
}
func (b *LocalBackend) tailfsRemoveShareLocked(name string) (map[string]string, error) {
func (b *LocalBackend) tailfsRemoveShareLocked(name string) (map[string]*tailfs.Share, error) {
fs, ok := b.sys.TailFSForRemote.GetOK()
if !ok {
return nil, errors.New("tailfs not enabled")
@ -179,20 +180,12 @@ func (b *LocalBackend) tailfsRemoveShareLocked(name string) (map[string]string,
}
fs.SetShares(shares)
return shareNameMap(shares), nil
}
func shareNameMap(sharesByName map[string]*tailfs.Share) map[string]string {
sharesMap := make(map[string]string, len(sharesByName))
for _, share := range sharesByName {
sharesMap[share.Name] = share.Path
}
return sharesMap
return maps.Clone(shares), nil
}
// tailfsNotifyShares notifies IPN bus listeners (e.g. Mac Application process)
// about the latest set of shares, supplied as a map of name -> directory.
func (b *LocalBackend) tailfsNotifyShares(shares map[string]string) {
func (b *LocalBackend) tailfsNotifyShares(shares map[string]*tailfs.Share) {
b.send(ipn.Notify{TailFSShares: shares})
}
@ -205,7 +198,7 @@ func (b *LocalBackend) tailFSNotifyCurrentSharesLocked() {
return
}
// Do the below on a goroutine to avoid deadlocking on b.mu in b.send().
go b.tailfsNotifyShares(shareNameMap(shares))
go b.tailfsNotifyShares(maps.Clone(shares))
}
// TailFSGetShares returns the current set of shares from the state store,

8
tailfs/remote.go
View File

@ -21,16 +21,16 @@ func AllowShareAs() bool {
// Share configures a folder to be shared through TailFS.
type Share struct {
// Name is how this share appears on remote nodes.
Name string `json:"name"`
Name string `json:"name,omitempty"`
// Path is the path to the directory on this machine that's being shared.
Path string `json:"path"`
Path string `json:"path,omitempty"`
// As is the UNIX or Windows username of the local account used for this
// share. File read/write permissions are enforced based on this username.
// Can be left blank to use the default value of "whoever is running the
// Tailscale GUI".
As string `json:"who"`
As string `json:"who,omitempty"`
// BookmarkData contains security-scoped bookmark data for the Sandboxed
// Mac application. The Sandboxed Mac application gains permission to
@ -38,7 +38,7 @@ type Share struct {
// picker. In order to retain access to it across restarts, it needs to
// hold on to a security-scoped bookmark. That bookmark is stored here. See
// https://developer.apple.com/documentation/security/app_sandbox/accessing_files_from_the_macos_app_sandbox#4144043
BookmarkData []byte `json:"bookmarkData"`
BookmarkData []byte `json:"bookmarkData,omitempty"`
}
// FileSystemForRemote is the TailFS filesystem exposed to remote nodes. It